Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 00:43
General
- Target !!! DEPENDENCIES !!!\Win64OpenSSL_Light-3_6_0.exe
- Size 5.6MB
- Sample260416-a225dadv2k
- SHA256 b995a5fbbd9a3d03bf33f974496749e5743abae97e5561b814e1adf72306dce7
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\!!! DEPENDENCIES !!!\Win64OpenSSL_Light-3_6_0.exe"C:\Users\Admin\AppData\Local\Temp\!!! DEPENDENCIES !!!\Win64OpenSSL_Light-3_6_0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GU1JD.tmp\Win64OpenSSL_Light-3_6_0.tmp"C:\Users\Admin\AppData\Local\Temp\is-GU1JD.tmp\Win64OpenSSL_Light-3_6_0.tmp" /SL5="$50244,5598687,58368,C:\Users\Admin\AppData\Local\Temp\!!! DEPENDENCIES !!!\Win64OpenSSL_Light-3_6_0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_isdecmp.dll
Win64OpenSSL_Light-3_6_0.tmp
memory/1240-13-0x0000000002340000-0x0000000002942000-memory.dmp
memory/1240-0-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1240-12-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3848-23-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-39-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-14-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-15-0x0000000001050000-0x0000000001652000-memory.dmp
memory/3848-19-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-5-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3848-27-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-31-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-35-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-16-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3848-43-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-47-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-51-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-55-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-59-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-63-0x0000000000400000-0x00000000004BF000-memory.dmp
memory/3848-67-0x0000000000400000-0x00000000004BF000-memory.dmp